[Roger Brownell]

http://cdoctor.com/wp-includes/td06fnuu.php
Look what i found here

[Peter Wendel]

I suggest NOT opening the link in this message.

Peter Wendel

On Tue, Oct 2, 2012 at 3:23 AM, Roger Brownell <rogerb...@yahoo.com> wrote:

http://cdoctor.com/wp-includes/td06fnuu.php
Look what i found here

--
You received this message because you are subscribed to the Google Groups "corvallis-etailing" group.
To post to this group, send email to corvallis...@googlegroups.com.
To unsubscribe from this group, send email to corvallis-etail...@googlegroups.com.
For more options, visit this group at http://groups.google.com/group/corvallis-etailing?hl=en.

[Mike Fay]

Hello,

The reason to not open the site is:

  

Mike

[Pam Hood Szivek]

Can someone go to my site (corvallischildrenstherapy.com) and see if they get same message?  Pishers are using my .com name, but it doesn't originate on my site.

Sent from my iPad

Pam

On Oct 4, 2012, at 9:32 PM, Mike Fay <ja...@jam-assoc.com> wrote:

Hello,

The reason to not open the site is:

   <dbaihhdc.png>

[Dave Regan]

The main web page isn't the issue.  If you look at the URL that started this:
   http://cdoctor.com/wp-includes/td06fnuu.php
it's possible that the main web page for cdoctor.com is just fine.  However, the vandal managed to create a bogus page on the site that vectors off to russia.

So the real question is if you have any bogus pages on your web site that aren't yours.  If you have seen any of the phishing messages, look at the URLs they are referring to.  Alternatively, look at your access log for unusual web pages that are returning results.

If either of these prove to show you have a problem, the first thing to do is to delete the offending page.  The second thing to do is to make sure any software on the web site is current.  The one above is a Word Press site.  The last thing to do, if possible, is to understand how the vandal got into your site to change content in the first place, though updating the software may have closed the door.

Trying to figure out how a web site was defaced can be difficult.  However, unless you close the door, the web site will be defaced using the same technique in the future.

    Dave Regan

[Pam Hood Szivek]

Thanks, Dave.
Pam

 

Pam Hood-Szivek
541-974-7709

---

From: Dave Regan <armoredpe...@gmail.com>
To: corvallis...@googlegroups.com
Sent: Friday, October 5, 2012 7:48 AM
Subject: Re: SPAM-MED: Re: [corvallis-etailing]

[Colleen Dick]

looks fine 2 me I didn't get a phish.  guess u fixed it.

On Fri, Oct 5, 2012 at 7:38 AM, Pam Hood Szivek <mspam...@yahoo.com> wrote:

[Loyan Roylance]

Pam,

Here is a simple tool I found recently to see if your mail server may be blacklisted. 

http://mxtoolbox.com/blacklists.aspx